---
id: "CVE-2026-76302"
kind: "vulnerability"
aliases: ["CVE-2026-76302"]
title: "Splunk Enterprise: hardening release fixes several critical internal flaws"
severity: "critical"
cvss: 9.9
epss: 0.00378
exploited: false
status: "open"
category: "vendor"
products: [{"name": "Splunk Enterprise", "fixed": ["10.4.4", "10.2.8", "10.0.11", "9.4.16"], "affected": ">= 10.4.0, < 10.4.4; >= 10.2.0, < 10.2.8; >= 10.0.0, < 10.0.11; >= 9.4.0, < 9.4.16", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["cisco", "infrastructure", "self-hosted", "splunk", "splunk-enterprise", "vendor"]
not_affected_if: ["splunk-cloud", "version-outside-affected-ranges"]
published_at: "2026-10-21T23:17:28+00:00"
first_seen_at: "2026-10-23T21:57:29+00:00"
updated_at: "2026-10-24T13:15:54+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-76302", "first_seen_at": "2026-10-23T21:57:29+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T22:25:10+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-76302", "first_seen_at": "2026-10-24T13:15:54+00:00"}]
---

# Splunk Enterprise: hardening release fixes several critical internal flaws

Cisco's Splunk Enterprise has multiple internally found flaws tracked under CWE-707 (improper neutralization) that were fixed in a hardening release. The sources do not say what an attacker can actually do with them.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Splunk Enterprise affected >= 10.4.0, < 10.4.4; >= 10.2.0, < 10.2.8; >= 10.0.0, < 10.0.11; >= 9.4.0, < 9.4.16 fixed 10.4.4, 10.2.8, 10.0.11, 9.4.16

## How to check

Run splunk version on the Splunk host and compare it to the affected ranges: 10.4.0 to before 10.4.4, 10.2.0 to before 10.2.8, 10.0.0 to before 10.0.11, 9.4.0 to before 9.4.16.

## Fix

Upgrade to Splunk Enterprise 10.4.4, 10.2.8, 10.0.11 or 9.4.16, matching your release line.

## Timeline

- 2026-10-23T21:57:29+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-76302
- 2026-10-23T22:25:10+00:00 analyst — Product is Splunk Enterprise (Cisco-owned), per Splunk SVD-2026-1008 (primary). Vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H confirmed. Advisory gives no technical detail; no exploitation or PoC found. Sibling CVEs: 76299 (9.9), 76300, 76301 in same advisory.
- 2026-10-24T13:15:54+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-76302

## Documents

- [advisory] SVD-2026-1008 Security Hardening in Splunk Enterprise - October 2026 https://advisory.splunk.com/advisories/SVD-2026-1008
- [describes] CVE Record CVE-2026-76302 https://www.cve.org/CVERecord?id=CVE-2026-76302

## From the sources

As part of Cisco's ongoing commitment to proactive security and product quality, Cisco has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-76302 are related to improper neutralization and are grouped under the Common Weakness Enumeration (CWE) CWE-707.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_